Blue Team Operations & Defense

Header Deconstruction: Extract SPF, DKIM, and DMARC verdicts from Authentication-Results . Verify if Return-Path matches the From address.
Scope Validation: Run tenant-wide message trace using message-ID or Subject to check total recipients and whether any users clicked or opened attachments.
Attachment Sandboxing: Submit hashes to VirusTotal / Hybrid Analysis. Deobfuscate embedded macros or SVG attachments in a secure sandbox.
Remediation Actions: Purge messages from all mailboxes via admin search-and-purge; block sending domain/IP at the email security gateway; revoke sessions and force password resets if credentials were submitted.

Operational playbooks, hunt queries, regex repositories, and SOC management blueprints.

Threat Library

Select an operational sub-category to view tactics, detection indicators, and analyst procedures.